Handling of !cmd under ^\ menu in ssh(1) were imported from con(1) a bit incorrect which causes it to work half-duplex only.  This patch fixes it so xms/xmr work properly with it now.

Reference: /n/sources/patch/applied/ssh-menu
Date: Wed Jul 20 18:14:00 CES 2011
Signed-off-by: yarikos@gmail.com

--- /sys/src/cmd/ssh/ssh.c	Wed Jul 20 18:06:31 2011
+++ /sys/src/cmd/ssh/ssh.c	Wed Jul 20 18:06:27 2011
@@ -14,6 +14,14 @@
 void winchanges(Conn*);
 static void	sendwritemsg(Conn *c, char *buf, int n);
 
+/*
+ * Lifted from telnet.c, con.c
+ */
+static int consctl = -1;
+static int outfd=1;	/* changed during system */
+static void system(Conn*, char*);
+
+
 Cipher *allcipher[] = {
 	&cipherrc4,
 	&cipherblowfish,
@@ -234,6 +242,7 @@
 	return s;
 }
 
+
 void
 fromnet(Conn *c)
 {
@@ -289,7 +298,7 @@
 			break;
 
 		case SSH_SMSG_STDOUT_DATA:
-			fd = 1;
+			fd = outfd;
 			goto Dataout;
 		case SSH_SMSG_STDERR_DATA:
 			fd = 2;
@@ -312,14 +321,6 @@
 }		
 
 /*
- * Lifted from telnet.c, con.c
- */
-
-static int consctl = -1;
-static int outfd1=1, outfd2=2;	/* changed during system */
-static void system(Conn*, char*);
-
-/*
  *  turn keyboard raw mode on
  */
 static void
@@ -446,7 +447,7 @@
 		perror("pipe");
 		return;
 	}
-	outfd1 = outfd2 = pfd[1];
+	outfd = pfd[1];
 
 	wasconsctl = consctl;
 	close(consctl);
@@ -473,8 +474,7 @@
 		while((n = read(pfd[1], buf, sizeof(buf))) > 0)
 			sendwritemsg(c, buf, n);
 		p = waitpid();
-		outfd1 = 1;
-		outfd2 = 2;
+		outfd = 1;
 		close(pfd[1]);
 		if(p < 0 || p != pid)
 			return;